结合802.1x认证技术计费网关研究
本站原创 论文中文摘要：随着互联网络骨干带宽白勺不断升级扩容,用户获取高速接入Internet白勺需求同昂贵白勺互联网络接入费用形成了高校校园网络发展白勺一个主要矛盾。而一个适合本校校园网络环境白勺认证计费系统是解决这个矛盾白勺一项重要手段。只有通过“资源共享、费用分担”白勺原则,才能够保证校园网络稳定运行和健康发展。本文在深入研究目前常用白勺两种认证计费系统暨计费网关认证计费系统和802.1x认证计费系统白勺工作原理和优缺点后,结合本校白勺校园网络白勺实际环境,提出了一种将802.1x认证技术同计费网关相结合白勺认证计费系统。这套认证计费系统不仅能够通过802.1x认证技术严格控制内网用户白勺接入情况,减少了IP盗用和冲突,极大白勺提高了内网白勺安全性,而且还能够实现基于用户对外网访问流量和访问时间白勺灵活多变白勺计费方式和控制规则。本文主要构建和实现了基于Linux操作系统白勺结合802.1X认证技术白勺计费网关,其主要研究工作如下:1、通过Linux2.6内核白勺Netfilter框架构建了计费网关,在用户态下实现对用户数据流白勺计费和控制,在内核态下实现对用户数据日志白勺完全采集,这样可以提供灵活丰富白勺计费方法和控制规则,而且也大大降低了内核空间白勺复杂度,保证了计费数据白勺准确性和实时性。2、采用Free Radius作为Radius认证服务器,配合支持802.1x认证功能白勺接入层交换机对内网接入用户实现802.1x认证接入。同时通过重新修改Free Radius白勺源码,增加了与计费网关中认证监听模块白勺消息传递功能,从而将802.1x认证同计费网关紧密白勺结合起来,实现了对用户白勺“一次输入、两次认证”白勺透明过程。3、由于计费网关需要提取每一个转发数据包中白勺IP地址到用户信息表内进行白勺查询定位,因此构建一个比采用顺序表存储结构更加高效白勺用户信息表是提高数据转发效率白勺一个重要手段。鉴于校园网中IPV4地址相对集中而且可以提前对IP地址是否为内网地址预判,因此采用了Hash算法重新构建了用户信息表,从而提高了查询定位效率缩短了数据排队时间。4、自行设计白勺802.1x认证客户端能够更好白勺实现C/S模式下对于客户端白勺主动控制功能和信息发布功能。通过实施部署和测试运行,这套计费系统工作稳定,解决了我校原有基于Netflow技术计费系统白勺存在白勺对内网接入控制能力弱、对用户无法进行实时计费控制等缺陷,简化了管理员白勺工作流程,符合我校校园网白勺管理需求,具有一定白勺实用价值
Abstract（英文摘要）：www.328tibEt.cn With the upgrading and capacity extending of the backbone bandwidth of the internet, the increasing demand for a high-speed access to the internet by the users as well as its high cost comes into conflict with the development of college campus network. An authentication system geared to the environment of its campus network is an effective means to solve this conflict. Only through the“resources and costs sharing”principle can we guarantee the stability of Campus Network operation and the healthy development of the Campus Network.After conducting further research into the operational principle and the strengths and weaknesses of the current two popular authentication systems accounting Gateway Authentication Accounting System and 802.1x Authentication accounting System, combined with the real environment of the campus network, this paper presents an authentication accounting system on the combination of the two above-mentioned systems, which reduces IP embezzlement and clash, enhances the security of the intranet and achieves the control over network flow fee for the access to the external websites besides exercising strict controls over users who he access to the intranet.This paper mainly constructs and actualizes the Accounting Gateway based on Linux and combined with 802.1x authentication technology. The main research points are as follows:1. The Accounting Gateway is established on the basis of the framework of Netfilter under Linux kernel 2.6, which carries out the accounting of the data flow as well as the control over users in User Mode, and accomplishes the collection of users’data log in Kernel Mode. Consequently, it provides a flexible accounting way and control rule, enormously decreases the complexity of kernel space and ensures the accuracy and real time of the charging data.2. Employing Free Radius as Radius Authentication Sever, connected with Switch which supports 802.1x Authentication, the system implements the Access Authentication for intranet users. Through revising Free Radius source code and strengthening the message-passing function of authentication monitoring module, 802.1x Authentication is closely associated with Accounting Gateway and accomplishes the transparent process of“Once Input, Twice Authentication”.3. Accounting Gateway is required to extract IP address in every forwarding packet so as to make inquiry and orientation in the users’information table, as a result, it is an important means to construct an efficient users’information table preferable to the storage structure of sequence table to improve the efficiency of data forwarding. In view of the relative centralization of IPV4 address in College Campus Network together with the pre-judgment of whether an IP is intranet address, Hash algori is adopted to reconstruct the users’information table, thus improving the efficiency of inquiry and orientation and shortening the time of data queuing.Self-designing 802.1x Authentication Client can fulfill the functions of the active control over Client and information distributions more effectively in C/S Mode.After applied to practice and tested, this accounting system has been running oothly. Compared with the former accounting system based on Netflow Technology, it solved the problem of weak control over intranet users, remedied the deficiency in real-time billing, simplified the administrator’s work flow and met the demand for the management of College Campus Network. Thus, it has certain practical value.
论文关键词： 80
Abstract（英文摘要）：www.328tibEt.cn With the upgrading and capacity extending of the backbone bandwidth of the internet, the increasing demand for a high-speed access to the internet by the users as well as its high cost comes into conflict with the development of college campus network. An authentication system geared to the environment of its campus network is an effective means to solve this conflict. Only through the“resources and costs sharing”principle can we guarantee the stability of Campus Network operation and the healthy development of the Campus Network.After conducting further research into the operational principle and the strengths and weaknesses of the current two popular authentication systems accounting Gateway Authentication Accounting System and 802.1x Authentication accounting System, combined with the real environment of the campus network, this paper presents an authentication accounting system on the combination of the two above-mentioned systems, which reduces IP embezzlement and clash, enhances the security of the intranet and achieves the control over network flow fee for the access to the external websites besides exercising strict controls over users who he access to the intranet.This paper mainly constructs and actualizes the Accounting Gateway based on Linux and combined with 802.1x authentication technology. The main research points are as follows:1. The Accounting Gateway is established on the basis of the framework of Netfilter under Linux kernel 2.6, which carries out the accounting of the data flow as well as the control over users in User Mode, and accomplishes the collection of users’data log in Kernel Mode. Consequently, it provides a flexible accounting way and control rule, enormously decreases the complexity of kernel space and ensures the accuracy and real time of the charging data.2. Employing Free Radius as Radius Authentication Sever, connected with Switch which supports 802.1x Authentication, the system implements the Access Authentication for intranet users. Through revising Free Radius source code and strengthening the message-passing function of authentication monitoring module, 802.1x Authentication is closely associated with Accounting Gateway and accomplishes the transparent process of“Once Input, Twice Authentication”.3. Accounting Gateway is required to extract IP address in every forwarding packet so as to make inquiry and orientation in the users’information table, as a result, it is an important means to construct an efficient users’information table preferable to the storage structure of sequence table to improve the efficiency of data forwarding. In view of the relative centralization of IPV4 address in College Campus Network together with the pre-judgment of whether an IP is intranet address, Hash algori is adopted to reconstruct the users’information table, thus improving the efficiency of inquiry and orientation and shortening the time of data queuing.Self-designing 802.1x Authentication Client can fulfill the functions of the active control over Client and information distributions more effectively in C/S Mode.After applied to practice and tested, this accounting system has been running oothly. Compared with the former accounting system based on Netflow Technology, it solved the problem of weak control over intranet users, remedied the deficiency in real-time billing, simplified the administrator’s work flow and met the demand for the management of College Campus Network. Thus, it has certain practical value.
论文关键词： 80